Re: [TLS] Consensus call on Implicit IV for AEAD

'I'd rather keep the nonce sane though, it keeps it easy to reason about the
construction.'

This is also the reason I would prefer not involving the nonce. It would
also help keeping the design for IPsec and TLS close.

On Mon, Apr 6, 2015 at 12:24 PM, Martin Thomson <martin.thomson@gmail.com>
wrote:

> On 3 April 2015 at 20:17, Brian Smith <brian@briansmith.org> wrote:
> > a clear record of my objection to the
> > zero-padding mechanism on the mailing list,
>
> For the record then, the objection was this:
>
> If you are concerned that someone might spend a large amount of
> computing resources (2^60+ iterations) to gain themselves a reasonable
> chance of decrypting a randomly selected session from a similar sized
> set of sessions, pick a stronger cipher.
>
> There's a history of attempting to paper over perceived weaknesses in
> the crypto we use.  I get the belt and braces approach here, but I'd
> rather see us develop stronger constructions (ChaCha+Poly uses a
> longer key, for example).
>
> If the complaint is specific to AES-GCM, I see nothing stopping
> someone from proposing AES-GCMv2 that operates on extra keying
> material internally in order to make the IV unpredictable.  I'd rather
> keep the nonce sane though, it keeps it easy to reason about the
> construction.
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
Daniel Migault
Ericsson